We are trying to develop a GENERIC WAF Rule for SQLI Prevention for WordPress-based websites that can provide some level of effectiveness with a very low probability of having false positives.
From my understanding I think we can provide some level of protection by default using these things:
- Matching for table_names, information_schema, etc.
- Matching for common SQLI Payload-based keywords like 'UNION', 'SELECT' etc. (This is prone to false positives because of a lot of common English words.) If > 2 matches then we can block.
If required, we can create a rule for each subcategory like Union-based, Error-based, time-based, AND/OR-based.
Like for Blind-based, we can consider the fact that they need to send a higher number of requests.
We are creating a generic rule so we don't expect it to block all bad requests.
SQLI is a serious issue for WordPress plugins mostly because of developers' mistakes and the PHP ecosystem. So, a preinstalled generic rule can provide at least some protection.
Is this a good idea? Is this question too open-ended? Any suggestions?
